System and Method for Wiping Encrypted Data on a Device Having File-Level Content Protection

1. A computer-implemented method for erasing user data stored in a file system, the method causing a computing device to perform steps comprising: receiving, by the computing device, through a wireless data connection, erasure instructions from a master device, wherein the master device generates the erasure instructions in response to the computing device being reported as lost or stolen; erasing, by the computing device, in response to receiving the erasure instructions, all key sets containing encryption keys loaded in a volatile memory on the computing device and all key sets containing encryption keys stored in a file system on the computing device, wherein the file system on the computing device uses file-level data protection; sending, by the computing device, in response to the erasing, incremental confirmations of at least one step of execution of the erasure instructions to the master device through the wireless data connection; erasing and rebuilding, subsequent to the erasing, at least part of the file system associated with user data; creating, subsequent to the erasing and rebuilding, a new default key set containing class encryption keys, wherein each class encryption key is encrypted using a unique code specific to the computing device, and the unique code is only usable by the computing device; and rebooting the computing device.

2. The computer-implemented method of claim 1 , the method further causing the computing device to transmit a confirmation to the master device indicating that all key sets are erased, at least part of the file system is erased and rebuilt, and the new default key set is created.

3. The computer-implemented method of claim 1 , the method further causing the computing device to, before erasing all key sets, receive via the computing device a user command to erase user data.

4. The computer-implemented method of claim 1 , wherein the wireless data connections is one of a cellular data connection and a wireless fidelity connection.

5. The computer-implemented method of claim 1 , wherein the file system encrypts each file with a unique file encryption key and encrypts each unique file encryption key with a class encryption key, wherein the class encryption key corresponds to an assigned protection class of the file, and the protection class includes certain file behavior and access rights for the file.

6. The computer-implemented method of claim 5 , wherein the file system encrypts each class encryption key, using a user key and the unique code specific to the computing device, in response to enabling of data protection on the computing device, to form an encrypted protection class key, wherein the user key is based upon a passcode associated with the user data.

7. The computer-implemented method of claim 6 , wherein the key sets comprise a default key set that includes all class encryption keys encrypted by the unique code specific to the computing device.

8. The computer-implemented method of claim 6 , wherein the key sets comprise a protected key set that includes all class encryption keys encrypted by the user key and the unique code specific to the computing device.

9. The computer-implemented method of claim 6 , wherein the key sets comprise an escrow key set that includes all class encryption keys encrypted by the unique code specific to the computing device and a public key relating to an asymmetric key pair.

10. The computer-implemented method of claim 9 , wherein the public key is not related to the user key.

11. The computer-implemented method of claim 9 , wherein the key sets comprise a backup key set that includes all class encryption keys encrypted by the public key.

12. A system for erasing user data stored in a file system, the system comprising: a processor; and a memory storing computer executable instructions that when executed by the processor cause the processor to: receive, through a wireless data connection, erasure instructions from a master device, wherein the master device generates the erasure instructions in response to a computing device being reported as lost or stolen; erase, in response to receiving the erasure instructions, all key sets containing encryption keys loaded in a volatile memory on the computing device and all key sets containing encryption keys stored in a file system on the computing device, wherein the file system on the computing device uses file-level data protection; send, in response to the erasing, incremental confirmations of at least one step of execution of the erasure instructions to the master device through the wireless data connection; erase and rebuild, subsequent to the erasing, at least part of the file system associated with user data; create, subsequent to the erasing and rebuilding, a new default key set containing encryption keys, wherein each encryption key is encrypted using a unique code specific to the computing device, and the unique code is only usable by the computing device; and reboot the computing device subsequent to creating the new default key set.

13. The system of claim 12 , wherein the executable instructions, when executed by the processor, further cause the processor to transmit a confirmation to the master device indicating that all key sets are erased, at least part of the file system is erased and rebuilt, and the new default key set is created.

14. The system of claim 12 , wherein the executable instructions, when executed by the processor, further cause the processor to, before erasing all key sets, receive via the computing device a user command to erase user data.

15. The system of claim 12 , wherein the file system encrypts each file with a unique file encryption key and encrypts each unique file encryption key with a class encryption key, wherein the class encryption key corresponds to an assigned protection class of the file, and the protection class includes certain file behavior and access rights for the file.

16. The system of claim 15 , wherein the file system encrypts each class encryption key, using a user key and the unique code specific to the computing device, in response to enabling of data protection on the computing device, to form an encrypted protection class key, wherein the user key is based upon a passcode associated with the user data.

17. A non-transitory computer-readable storage medium storing instructions that, when executed by a computing device, cause the computing device to erase user data stored in a file system, the instructions comprising: receiving, through a wireless data connection, erasure instructions from a master device, wherein the master device generates the erasure instructions in response to the computing device being reported as lost or stolen; erasing, by the computing device in response to receiving the erasure instructions, all key sets containing encryption keys loaded in a volatile memory on the computing device and all key sets containing encryption keys stored in a file system on the computing device, wherein the file system on the computing device uses file-level data protection; sending, by the computing device in response to the erasing, incremental confirmations of at least one step of execution of the erasure instructions to the master device through the wireless data connection; erasing and rebuilding, subsequent to the erasing, at least part of the file system associated with user data; creating, subsequent to the erasing and rebuilding, a new default key set containing encryption keys, wherein each encryption key is encrypted using a unique code specific to the computing device, and the unique code is only usable by the computing device; and rebooting the computing device subsequent to creating the new default key set.

18. The non-transitory computer-readable storage medium of claim 17 , the instructions further comprising transmitting a confirmation to the master device indicating that all key sets are erased, at least part of the file system is erased and rebuilt, and the new default key set is created.

19. The non-transitory computer-readable storage medium of claim 17 , wherein the file system encrypts each file with a unique file encryption key and encrypts each unique file encryption key with a class encryption key, wherein the class encryption key corresponds to an assigned protection class of the file, and the protection class includes certain file behavior and access rights for the file.

20. The non-transitory computer-readable storage medium of claim 17 , wherein the file system encrypts each class encryption key, using a user key and the unique code specific to the computing device, in response to enabling of data protection on the device, to form an encrypted protection class key, wherein the user key is based upon a passcode associated with the user.